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METHOD AND APPARATUS FOR PROTECTING NTRU AGAINST A TIMING 



2 



ATTACK 



3 

4 This application is a non-provisional application claiming priority from United States Provisional 

5 Application No. 60/433,015 filed December 13, 2002 and United States Provisional Application 

6 No, 60/459,268 filed April 2, 2003. 
7 

8 BACKGROUND OF THE INVENTION 
9 

1 0 FIELD OF THE INVENTION 

1 1 [0001J Ttie present invention relates to a method and apparatus for performing public key 

12 cryptography. 
13 

14 DESCRIPTION OF THE PRIOR ART 

1 5 [0002 J When communicating over public networks, it is often necessary to secure 

1 6 communications in order to prevent interception or fraud by a third party. Cryptographic 

17 schemes often use intractable mathematical problems to ensure security of communications. In 

1 8 private key systems, two correspondents share a secret key prior to initiating communications. 

1 9 They can then employ an encryption algorithm using the secret value to keep their 

20 communication private from those who do not know the secret value. However, with such 

21 systems it is necessary for the two correspondents to agree on the secret beforehand, which may 

22 be as difficult as communicating securely in the first place. 

23 [00031 Public key cryprosystems address the problem of distributing keys by assigning a pair 

24 of keys to each user. Each user has a private key and a corresponding public key, which are 

25 mathematically related so that it is computationally infeasiblc to derive the private key from the 

26 public key. The public key may be published and therefore made widely available to all users, 

27 To encrypt a message for a particular recipient, the sender uses the recipient's public key. Only 

28 the recipient knows the corresponding private key and therefore is the only party able to decrypt 

29 the message. 
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1 [0004] NTRU is a public key encryption system described in US Patent No, 6,08 1,597. The 

2 NTRU system uses a mathematical structure called a truncated ring of polynomials, which is 

3 denoted by R. The NTRU system uses four publicly known system parameters to initially set up 

4 the system. These are the degree of polynomials N, two moduli p 9 q 9 and the window parameter 

5 7. Typically, p is chosen to be 3 or and q is chosen to be a power of 2. The elements of 

6 the ring R may be represented as polynomials of a degree less than N. Operations in the ring are 

7 performed by polynomial addition and multiplication with the additional identity that -1 . 

8 [0005] To generate keys in the NTRU system, each user chooses secret polynomials / and g 

9 in the ring R. From the polynomial /, the user computes inverses modulo p and q which are 

10 denoted as f~ x and f~ x respectively. The user can then compute its public key A as f^g* The 



11 private key consists of the polynomials/and f p . 

12 [0006] When a second user wants to send the first user an encrypted message, it uses the first 

13 user's public key h. The second user also has access to the system parameters. A message m is 

14 encrypted as e=m + prh (mod q). The value r is randomly chosen for each encryption. 

1 5 [0007] Upon receipt of an encrypted message m, the recipient decrypts the message by 

16 computing a = e/[mod q). The recipient then establishes a window in the range to ^ . The 

17 recipient selects coefficients for a in the window. The recipient computes m = a f~ x (mod p). 

1 8 The recipient then checks that m is in the set of valid messages. If m is in the set of valid 

19 messages, then the message has been recovered. Otherwise, the recipient chooses a new window 

20 and proceeds to select coefficients in the new window. The four mentioned steps are repeated. 

21 This may continue for multiple windows until a valid message is found. Once a valid message is 

22 found, execution will stop. If all of the possible windows are exhausted and no valid message 

23 has been found, then the recipient will experience an error condition and report that the message 

24 cannot be deciphered. 

25 [0008] In order to avoid indecipherable messages, it has been suggested that the parameter T 

26 be chosen to be at least 30, and as large as 1 50. Since a large number of windows may be tested, 

27 it is likely that a valid message will be found eventually. In most cases however it is not 

28 necessary to check all of the windows. 
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l. 

1 

2 
3 
4 

5 SUMMARY OF THE INVENTION 

6 (0009] The inventors have recognised a vulnerability in the NTRU decryption process which 

7 may be exploited to determine private keys. The vulnerability exploits indecipherable messages 

8 in order to determine multiple bits of the secret key, 

9 [0010] The attack proceeds by first finding one message m and one random value r such that 

10 the encryption e =m + prh (mod q) is indecipherable. This step is performed by choosing 

1 1 random messages and values r and sending them to the victim for decryption. When decryption 

12 fails, it can be noted that the message is indecipherable. In the alternative, the time required to 

13 process the message may be measured. Indecipherable messages will require many windows to 

14 be tested during decryption, and accordingly will require more time than valid messages. It will 

15 be recognised that this attack requires that the victim decrypt messages of the attacker's 

16 choosing. 

1 7 [001 1) Once the attacker has determined one particular message m and a corresponding value 

18 r which yield an indecipherable encryption, the attacker then proceeds to find further 

19 indecipherable messages. The attacker proceeds by choosing a new random value 77, and then 

20 encrypting m with i\ . The attacker then tests if m + prjh can be decrypted. If this message 

2 1 cannot be decrypted, then it is saved for further use in the attack. The attacker then repeats the 

22 step of choosing a new random value and proceeds to find random values ri, rj, etc. before 

23 proceeding with the next phase of the attack. 

24 [0012) Once the attacker has contained a large enough number of decipherable messages, the 

25 attacker examines the r t values which have been found. The attacker looks at each co-ordinate, 

26 and counts the number of values which occur for each co-ordinate. Because of the structure of 

27 the encryption equation, there is likely to be a correlation between the co-efficients of these 

28 values n, and the co-efficients of the private polynomial g. Once the statistics have been 

29 accumulated, the attacker predicts a value of g from the distribution of the co-efficients of the n 

TQ0001-Q466-US 

020488^7041 3 
McCarthy T&rault LLP TOO-RED U82J54JS v. / 



Oec-15-03 01:25pm From-MC TET SERVICES +41 68680673 T-2II P. 012/043 F-039 

t 

1 values. This value of the polynomial g may then be used to determine the value of f~ x from the 

2 equation for the public key h. The attacker may thus determine all of the private values of the 

3 cryptosystem and therefore break the system 

4 [0013] The inventors have recognised that avoiding the above attack may be performed by 

5 having the decryptor perform a constant amount of work for each decryption. This is 

6 accomplished by always testing all possible windows even when a valid message has already 

7 been found. The attacker therefore cannot determine which messages are actually indecipherable 

8 and the attack will be avoided. Preferably, the value of T is chosen to be less than 30 and more 

9 preferably less than 10 in order that the additional work from testing all windows is minimised. 

10 Ideally, the value of Twill be chosen to be 1, 2, or 3. 

1 1 (0014] According to one aspect there is provided a method of decrypting a message 

12 encrypted using a truncated ring cryptosystem. The method comprises selecting a window 

13 parameter T determining a plurality of windows of a predetermined size, each window being 

14 shifted by an amount less than or equal to the window parameter T. A decryption candidate is 

15 determined for each possible window. Each decryption candidate is tested to determine whether 

16 it is a valid message. The result of the decryption is chosen to be a valid message found in the 

17 previous step or if no valid message is found it is indicated that the message could not be 

18 decrypted. By this method, a constant number of decryption candidates are determined for each 

19 decryption. 

20 [0015] According to another aspect, there is provided a method of decrypting a message 

21 encrypted using a truncated ring cryptosystem. The method comprises generating a random 

22 sequence of integers less than a fixed value, each integer corresponding to a window of a 

23 predetermined size and being shifted by the amount of the integer. Decryption candidates are 

24 successively determined for each possible window, and tested until a valid message is found, and 

25 the valid message is chosen as the result of the decryption. If no valid message is found after 

26 each possible window is used, it is indicated that the message could not be decrypted. 

27 [0016] According to a further aspect, there is provided a method of selecting system 

28 parameters for a truncated ring cryptosystem. The method comprises selecting an initial set of 

29 parameters, generating private keys, testing the vulnerability of each private key to an attack on 
T00001-0466-US 

020488-337041 4 
McCarthy Tttrault LLP TDO-RED H821S413 v. ; 



Dec-15-03 01:25pm From-MC TET SERVICES +4168680673 T-2II P. 013/043 F-038 

1 the cryptosystem based on determining indecipherable messages and when the cryptosystem is 

2 vulnerable, repeatedly increasing the value of one of the parameters and re-testing the 

3 vulnerability until the vulnerability has been reduced. 

4 [0017] According to yet another aspect, there is provided a method of encryption with a 

5 truncated ring cryptosystem. The method comprises using first, second and third cryptographic 

6 hash functions to obtain a first string from a message and a number. The number is used as a 

7 second string. The first cryptographic hash function is sued to obtain a third string from the 

8 message and the number. A padded message is formed from the first, second, and third strings. 

9 The padded message is encrypted with an encryption function. 

10 (0018] According to a yet further aspect, there is provided a truncated ring cryptographic 

1 1 system comprising system parameters selected by testing the vulnerability of randomly chosen 

12 private keys to an attack based on determining indecipherable messages, an encryption engine, 

1 3 and a decryption engine. 

14 [0019] According to still another aspect, there is provided a truncated ring cryptographic 

1 5 system comprising system parameters including a window parameter less than 30, an encryption 

1 6 engine, and a decryption engine, 

17 [0020] According to a still further aspect, there is provided a decryptor for a truncated ring 

1 8 cryptographic system comprising a window parameter T determining a plurality of windows of a 

19 predetermined size, each window being shifted by an amount less than the window parameter T. 

20 The decryptor includes a calculator to determine a decryption candidate for each possible 

21 window and a tester to determine whether each decryption candidate is a valid message. A 

22 selector chooses the result of the decryption to be a valid message or if no valid message is found 

23 indicates that the message could not be decrypted. 

24 [0021] According to yet another aspect, there is provided a decryptor for a truncated ring 

25 cryptographic system comprising a random sequence of integers less than a fixed value, each 

26 integer corresponding to a window of a predetermined size and being shifted by the amount of 

27 the corresponding integer. The decryptor includes a calculator to determine a decryption 

28 candidate for each possible window and a tester to determine whether each decryption candidate 
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1 is a valid message. A selector chooses the first valid message found by the tester as the result of 

2 the decryption. 

3 [0022] According to still another aspect, there is provided a system parameter selector for a 

4 truncated ring cryptographic system comprising an initial set of parameters, a private key 

5 generator, an attack engine to determine the vulnerability of each private key to an attack on the 

6 cryptosystem based on determining indecipherable messages, and a parameter updater to 

7 repeatedly increase the value of one of the parameters and run the attack engine until the 

8 vulnerability of the system to the attack has been reduced. 

9 [0023] According to a still further aspect, there is provided an encryptor to encrypt a 

10 message in a truncated ring cryptographic system comprising a first, a second, and a third 

1 1 cryptographic hash function, and a generator to generate a number. A message padder is 

12 configured to fonn a padded message from a first string computed using the first, second and 

13 third cryptographic hash functions on the message and the number, a second string formed from 

14 the number and a third string computed using the first cryptographic hash function on the 

1 5 message and the number. An encryptor is provided to encrypt the padded message using an 

16 encryption function. 

1 7 [0024] According to one aspect there is provided a data carrier containing instructions to 

1 8 direct a processor to decrypt a message encrypted using a truncated ring cryptosystem. Hie data 

19 carrier includes instructions top select a window parameter T determining a plurality of windows 

20 of a predetermined size, each window being shifted by an amount less than or equal to the 

21 window parameter T. A decryption candidate is determined for each possible window. Each 

22 decryption candidate is tested to determine whether it is a valid message. The result of the 

23 decryption is chosen to be a valid message found in the previous step or if no valid message is 

24 found it is indicated that the message could not be decrypted. A constant number of decryption 

25 candidates are determined for each decryption. 

26 [0025] According to another aspect, there is provided a data carrier containing instructions to 

27 direct a processor to decrypt a message encrypted using a truncated ring cryptosystem. The data 

28 canier includes instructions to generate a random sequence of integers less than a fixed value, 

29 each integer corresponding to a window of a predetermined size and being shifted by the amount 
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1 of the integer. Decryption candidates are successively determined for each possible window, and 

2 tested until a valid message is found, and the valid message is chosen as the result of the 

3 decryption. If no valid message is found after each possible window is used, it is indicated that 

4 the message could not be decrypted. 

5 [0026] According to a further aspect, there is provided a data carrier containing instructions 

6 to direct a processor to select system parameters for a truncated ring cryptosystem. The data 

7 carrier includes instructions to select an initial set of parameters, generate private keys, test the 

8 vulnerability of each private key to an attack on the cryptosystem based on determining 

9 indecipherable messages and when the cryptosystem is vulnerable, repeatedly increase the value 

10 of one of the parameters and re-testing the vulnerability until the vulnerability has been reduced. 

1 1 [0027] According to yet another aspect, there is provided a data carrier containing 

12 instructions to direct a processor to encrypt a message using a truncated ring cryptosystem. The 

13 data carrier includes instructions to use first, second and third cryptographic hash functions to 

14 obtain a first string from a message and a number. The number is used as a second string. The 

15 first cryptographic hash function is sued to obtain a third string from the message and the 

16 number. A padded message is formed from the first, second, and third strings. The padded 

17 message is encrypted with an encryption function. 
18 

19 BRIEF DESCRIPTION OF THE DRAWINGS 

20 [0028] These and other features of tbe preferred embodiments of the invention will become 

21 more apparent in the following detailed description in which reference is made to the appended 

22 drawings wherein: 

23 [0029] Figure 1 is a schematic representation of a communication system; 

24 [0030] Figure 2 is a schematic representation of a method of encryption; 

25 [0031] Figure 3 is a schematic representation of a method of decryption; 

26 [0032] Figure 4 is a schematic representation of a method of an attack on the system of 

27 Figure 1; 

28 [0033] Figure 5 is a schematic representation of an alternate method of decryption; 

29 [0034] . Figure 6 is a schematic representation of a method of parameter selection; 
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C. 

* 

1 [0035] Figure 7 is a schematic representation of a method of padding; 

2 [0036] Figure 8 is a schematic representation of a circuit used to pad messages; 

3 [0037] Figure 9 is a schematic representation of a method of padding using the circuit of 

4 Figure 8; 

5 [0038] Figure 1 0 is a schematic representation of a circuit used to recover a message from a 

6 padded message; and 

7 [0039] Figure 1 1 is a schematic representation of a method performed by the circuit of 

8 Figure 10. 
9 

10 DESCRIPTION OF THE PREFERRED EMBODIMENTS 

1 1 [0040[ Referring to Figure 1, a communication system 10 includes correspondents 12, 14 

12 connected by a communication channel 16. The correspondent 12 wishes to send messages to 

13 the correspondent 14, and for this purpose has access to certain public parameters of the 

14 correspondent 14. The correspondent 14 has system parameters 22, private parameters 24 and a 

1 5 public key 26. he system parameters include a degree N, two moduli q and a window 

16 parameter T. The private parameters include randomly chosen polynomials / g and inverses off 

17 modulo q and modulo p. The public key is a value h computed from f~ x g. 

1 8 [0041] The correspondents 12, 14 also include cryptographic processors 28, 30 for 

1 9 performing cryptographic calculations. The correspondent 1 2 has a copy of a system parameters 

20 18 and the public 20 of correspondent 14. The correspondent 12 can therefore use these 

21 parameters in order to send encrypted messages to the correspondent 14. 

22 [0042] The NTRU cryptosystem as presented in US Patent No. 6, 081 ,597 depends on four 

23 parameters (TV, p y q, T) and four sets of integer polynomials of degree less than N. The sets 

24 include a message space L™, two key spaces L/ 9 L g , and a nonce space I r .. All of the integer 

25 polynomials belong to the ring R = Z[x]/(x N - 1) and * denotes multiplication in /?. The 

26 elements of the ring R may be represented as polynomials of a degree less than M Operations in 

27 the ring are performed by polynomial addition and multiplication with the additional identity that 

28 ^ =1 .The parameter q is selected to be a positive integer. The parameter p can then either be a 
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1 positive integer considerably smaller than q or a small polynomial (in the sense the/>(l) is small, 

2 in both cases p is required to be relatively prime to q in R. 

3 [00431 Polynomials in R will occasionally be reduced modulo q or p. When q and p are 

4 integers, this means reducing each coefficient modulo q or p respectively. If p is a polynomial 

5 then reducing x modulo p means finding a specific predetermined representative from the set 

6 x + Rp = {x + yp,yz R). Let: 

(\z has d x coefficients equal to 1 , d 7 coefficients equal to - 1 1 
[ and the remaining coefficients equal to 0 J 

8 [0044) If p is an integer then the window parameter Tis usually selected to be zero and Lf, 

9 Lg, Lr, and Lm are defined as follows. Define the message space L m as 



p-l 



/wgR;w has all coefficients in 

10 L m = I 

1 1 and define the key spaces L/, L g1 and the nonce space L r as 

12 Lf =L(d f9 df-\) 

13 l g =L(d g> d s ),md 

14 L r = L(dr,d r ), 

15 where d fi d gy and d r are positive integers, whose values depend on N, q 7 and p. 
16 

1 7 [0045] If p is a polynomial then define L m to be the unique representati ves of the sets x +Rp 

18 used in reducing modulo p. Note that to aid in decryption the representatives from x + Rp are 

1 9 selected so that the coefficients of polynomials in L m are small. The sets L fl L gi I r , and the 

20 integer T are then selected to allow the decryption algorithm to have a good probability of 

21 success. Generally this requires the coefficients of polynomials in L/ 7 L g9 and L r to be small. 

22 [0046] Key-pairs are generated by selecting two polynomials/ e L/Zudg e L g such that 

23 there exist polynomials /~ l and f~ { satisfying 

24 /* /; ! = l(modp)and 

25 /* = 1 (mod q) 
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1 The private key comprises the polynomials / and . The public key is the polynomial 

2 h=fi l g (mod?). 

3 v [0047] Referring to Figure 2, a method of encrypting a message is shown by the numeral 

4 100. At step 102, the correspondent 12 uses the system parameters N y p } q and T. The input 

5 parameters are a message m which the correspondent 12 wishes to send to the correspondent 14 

6 and the public key h of the correspondent 14. The correspondent 12 then chooses the random 

7 value r at step 104. The sender then computes e = m + prh (mod q) at step 106. 

8 [0048J Upon receipt of an encrypted message e the correspondent 14 performs the steps 

9 shown in Figure 3 by the numeral 200. The correspondent 14 first receives the encrypted 

10 message e at step 202. It then calculates at step 204 a a ef (mod q). It then sets a window at 

1 1 step 206. The window is initially set to the range to ^ . Then, at step 208 the correspondent 

12 14 selects coefficients of a in the cuiTent window. At step 210, the correspondent 14 computes 

13 M= a/" 1 (mod /?). Then, at step 212 the correspondent 14 checks thatMis in the set L m of 

14 valid messages. If the message M is valid at step 214 then the correspondent 14 uses the message 

15 as the recovered message at step 218. If however the message is not valid at step 214, then the 

16 correspondent 14 chooses a new window at step 216 and returns to step 208 to select new 

17 coefficients. 

18 [0049] Given a public key h and a message weU encryption E proceeds as follows, 

19 Select a random element r € U and calculate e=m+prh (mod q). Encryption may be denoted 

20 by £ h Qn; r) =e. 

21 [0050] Given a ciphertext e = m+prh (mod q) 9 decryption D f proceeds as follows. First 

22 calculate: 

a = ef (mod q) 

23 =mf + prhf(mQ&q) 
= mf + prg(modq) 

24 [0051] Now convert the modular reduction above to an integer polynomial by choosing 

25 integer representatives for the coefficients of a. 
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1 [0052] The NTRU parameters were selected in such a way that, for the vast majority of m 

2 and r 9 all the coefficients of mf+ prg fall in a range of width q centred at a value that can be 

3 determined from e. (Typically the centre is the expected value of the coefficients of mf + prg). 

4 Thus for most m and r, a equals mf + prg. 

5 [0053) In this case, decryption continues as follows: 



9 By definition of the message space, ifweLm then rn^rn (mod p) and thus a recovers the 

10 message m. 

1 1 [0054] If the above does not recover a valid message m, the range of width q is shifted by 1 

12 and the above reduction modulo q is repeated. If this does not recover a valid message, the range 

13 is shifted by -1 and the above modular reduction repeated. In the absence of a valid message 

14 being recovered, the shifting and reduction by 2, -2, and so on up to a shift by -7* at which point 

15 decryption is said to fail with a gap failure. The ciphertext in question is said to be an 

1 6 "indecipherable valid ciphertext." 

17 [0055] Thus if E* (m;r) = e then D N A {e) equals m precisely when fl = e/(modg) reduced 

18 to the expected range (shifted up to ±T 9 if need be) equals mf + prg. This can be used to find a 

1 9 good characterisation for which valid ciphertext will not decipher correctly. 

20 [0056] Referring to Figure 4, the method of attacking the NTRU system is shown generally 

21 by the numeral 300. The attacker first finds one message m and a nonce r such that e = m + prh 

22 (mod q) is indecipherable. The attacker then chooses the random value r% at step 304. The 

23 attacker then encrypts the message m using the random value n at step 306. The attacker then 

24 tests if m + prfi can be decrypted ax step 308. This is performed by sending the message to the 

25 victim. It may be necessary to monitor the amount of time that the victim requires to attempt to 

26 decrypt. At step 310, the attacker saves the pair m , r,- if the result of encrypted message is 

27 indecipherable. The attacker then repeats 3 12, the choice of random values at step 304 and step 
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1 306, 308 and 3 10 until it has accumulated sufficient values 17. The attacker then examines the 

2 co-ordinates of the n values which have been found at step 314. The attacker then predicts the 

3 value of the private polynomial g from the distribution of the coefficients in the r\ values at step 

4 316. 

5 [0057] The attack proceeds in two stages. Stage 1 : Randomly search through pairs {in/) e 

6 L m x Lr until the ciphertext generated from the pair (m,r) is an indecipherable valid ciphertext. In 

7 practice, this is carried out by encrypting a message to another party, transmitting the ciphertext, 

8 and observing whether the ciphertext is rejected as indecipherable. Because a successful 

9 decryption with few shifts happens with high probability, it suffices to note the time interval 

10 before rejection and assume that any ciphertext not rejected almost at once is indecipherable. 

1 1 [0058] Stage 2: Given the pair (m,r) found in Stage 1, let y = mf Typically;/ will have one 

12 co-efficient y which is closer to the boundary of decipherability than any other co-efficient. In 

13 this case, for random r , there will be a bias in the co-ordinates of mf + p r g that may cause the 

14 (m,^)-ciphertext to be indecipherable. 

1 5 [0059] The attack proceeds by randomly selecting many r and recording the value r for 

16 which e = m+prg (mod q) was indecipherable. Because of the bias in the "bad" co-ordinates of 

17 mf+prg, the values in the recorded r will have a correlation with the secret value g\ This 

1 8 allows g to be recovered by analysing the distributions of the values in the recorded r . The 

1 9 private key can then be recovered. (First, recover the value of f from g and h\ second, determine 

20 //from/) 

21 [0060] To limi t the number of indecipherable (m, r ) pairs required to determine g from the 

22 r , the attack can be combined with lattice techniques. 

23 [0061) If y = mf does have a large co-efficient then the rate at which the (m, r ) are 

24 indecipherable will be noticeably larger than the random m and r. Thus by analysing the rate at 

25 which r are found, we can determine whether^ has no large co-efficients, at which point we can 

26 simply return to Stage I. Ify = mf has two or more large co-efficients which are equally close to 

27 the decipherable boundary then the distributions of values in the r may not reveal g and the 

28 attack will need to return to Stage 1 . Note that in this latter case, some information about g may 
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1 still be determined. In practice, for randomly determined indecipherable (m,r,) there is a good 

2 chance thaty = m/has the desired properties. Thus we expect that the need to loop to Stage i 

3 will be infrequent. 

4 [0062] Referring to Figure 5, an embodiment of the invention in which alternate decryption 

5 is used is shown generally by the numeral 400. The recipient first receives an encrypted message 

6 e at step 402. It then calculates a =ef (mod q) at step 404. The recipient then selects co- 

7 efficients in the current window at step 406. At step 408 the recipient computes M - af p ' { (mod 

8 p). The recipient then checks if M is in the set of valid messages at step 410. If the message is 

9 valid at step 412, then the recipient records the valid message at step 414. It then proceeds to 

10 repeat the steps for each window at step 416. If the message is not valid then the recipient also 

1 1 repeats the steps for each window at step 416, In this way, the recipient performs the same 

12 number of operations regardless of how soon it finds a valid message. 

13 [0063] To protect against timing attacks, such as the above, it will be recognised that the 

14 decryption algorithm has been modified so that a constant amount of work is always done per 

15 ciphertext. This is accomplished by proceeding with the decryption steps for each of the 2F+ 1 

16 possible reduction ranges for a regardless of whether or not the message has been recovered. 

1 7 [0064] In an alternative embodiment, randomness is introduced into the sequence of 

1 8 windows. The possible windows 1, -1, 2, -2, -J, -Tare randomly rearranged. This selection 

1 9 of windows will reduce the information revealed by an indecipherable ciphertext since the 

20 attacker will not know which windows have been tried and in which order. 

21 [0065] In another embodiment of the invention, shown in Figure 6 by the numeral 500, the 

22 system parameters are chosen in order to reduce the likelihood of finding an indecipherable 

23 message. The likelihood of finding indecipherable messages is related to the system parameters 

24 TV, p, q, and T. Values for these parameters are initially chosen 502 to set up the cryptosystem. 

25 Once a private key and public key are generated, 504, the likelihood of finding indecipherable 

26 messages is calculated 506. If this value is more than a predetermined value 508, then one of the 

27 system parameters is modified 510. If not, then the parameters are used 512. The process may 

28 be repeated until desirable parameters are found. Preferably, q is increased in order to expand 

29 the window for co-efficients modulo q. 
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1 [0066] In an alternative embodiment, the decryptor monitors received encrypted messages, 

2 When a large number of indecipherable messages are detected, the decryptor selects new system 

3 parameters. Preferably, the new parameters provide a lower likelihood of obtaining 

4 indecipherable messages. 

5 [0067] In another embodiment, messages m (602) are padded with the nonce (604) as shown 

6 in Figure 7 in order to provide randomness throughout the message, This may be done by 

7 splitting the message into two parts m h m 2 and the nonce into two parts r/, and r 2 . Then the 

8 encrypted operation is perfonned on the concatenation mj || r ; || m 2 || r 2 (606, 608, 610, 6 17). 

9 Additional parts may be used to further mix bits of m with bits of r. 

10 [00681 In a further embodiment shown in Figures 8 and 9, an alternative method of padding 

1 1 messages is used. Referring to Figure 8, a circuit is shown generally by the numeral 700. The 

12 circuit 700 includes registers 702 and 704 which hold a message M and a random string R, 

13 respectively. The number of bits in the message m is denoted by fc/, and the number of bits in the 

14 random string R is denoted by k 2 . The circuit 700 outputs a padded message m and a padded 

1 5 nonce r of bit lengths mien and rlen respectively. The length mien is at least k/ + fe. The circuit 

16 uses a hash function F 706, a hash function G 714 and a hash function H 708. The hash 

1 7 functions FmH take as input a binary string of length fc/+ k 2 . The output of F is k 3 = mlen-k/- 

18 k 2 bits, hash function G takes input of kz + k 3 bits and produces output of kj bits. The hash 

1 9 functions F and H are connected to a concatenation of registers 702 and 704 to receive input of 

20 the binary string M \\ R of length h + k 2 . The output of the hash function F 706 is a value 

21 a=F(M || R) 710. The hash function G 714 uprights on a concatenation of R 704 and a 71 0 of bit 

22 length Aj. The output of the hash function G 714 is a value G(R || a716) of*/ bits. The register 

23 7 1 6 is connected to an XOR gate 718. The register M 702 is also connected to the XOR gate 

24 718. The output of the XOR gate 718 is a register 720 containing bM+G (R \\ a) of kj bils. The 

25 resulting message m is a concatenation of registers 720, 704, and 710 of kj + k 2 + h bits. 

26 NotationaUy, m = b \\ R \\ a. The output of the hash function H 708 is a value d=H(M \\ R) 712 of 

27 rlen bits. The value of d is used as the nonce r. 

28 [0069] In operation of the circuit 700, the steps 800 to Figure 9 are performed. First, at step 

29 802, a message M is obtained. Then, a random string R is obtained at step 804. Then the value a 
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1 is computed at step 806. The value a is equal to the value of the hash function F applied lo M \\ 

2 R, the concatenation of M and R. The value b is then computed at step 808 as M © G (R || a). 

3 At step 8 1 0, the values c and d are computed, where c - b \\ R || a and d = /f (Jtf || R). Finally, the 

4 result in values m and r are encrypted at step 812. Once the values have been encrypted as 

5 shown in Figure 9, a recipient will be able to decrypt them and obtain the original message M. 

6 Because of the padding, the additional steps of Figures 10 and 1 1 will be used by the recipient. 

7 [0070] Referring therefore to Figure 10, a circuit for recovering the message from the padded 

8 message is shown generally by the numeral 900. The circuit 900 takes as input an encrypted 

9 message 902. The circuit then applies the NTRU decryption method 904. The result of the 

10 decryption is a padded message m and a padded nonce r in registers 906, 908 respectively. 

1 1 Assuming the decryption is successful, these values will be equal to the values encrypted by the 

12 sender. The circuit 900 then splits the register 906 into three values b, R, a in registers 91 0, 912 

13 and 914 respectively. The hash function G 714 is connected to the registers 912 and 914 to 

14 produce a value G(R \\ a) stored in register 920. An XOR gate 918 is connected to the values 6, 

15 and register 910 and the register 920. The XOR gate produces a value in register 922 which is 

16 equal to b® G (R \\a). The hash function F 706 is connected to the registers 922 and 912 to 

17 produce a value of F(M \\ R) in register 924. A comparator 926 operates to compare register 924 

18 to the value a in register 914. 

1 9 [0071] Referring to Figure 1 1 , the steps performed by the circuit 900 are shown generally by 

20 the numeral 1000. An encrypted message is first obtained at step 1002. Then the encrypted 

21 message is decrypted with NTRU at step 1004. At step 1006 the value m is split into its 

22 components 6, R and a. Then the value M=b ® G(R \\ a) is computed at step 1 008. At step 1010, 

23 the value F {m \\ R) is compared to the value a. If the values are not the same, then the message 

24 is reported as invalid and step 1012, otherwise, these values are equal and the messages reported 

25 as valid at step 1014. The value Mis then returned at step 1016 as the result of the decryption. 

26 [0072] Now consider the control over m and r of an attacker who can select M and i?. Since 

27 r is generated from d - H (M \\ R) the attacker has no direct control over any of the bits which 

28 determine r. The attacker does have control over R and thus since m is generated from c = b\\R\\a 

29 the attacker can control at least k2 of the mien bits used to form m. Since a - F(M \\ R) and 
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1 b = M © G (R || a) the attacker does not have direct control over any of the bits of a or b ( The 

2 bits of a and b will change randomly when any of the bits of Rot M change). This said, die 

3 attacker can exert some control over the bits of a, b and d repeatedly trying Af, R combinations. 

4 However, as a 9 b, and d will change randomly for each M and R this control is limited by the 

5 amount of work which an adversary can perform, 

6 10062] It is recognized that there are many variations of this padding scheme which provide 

7 the desired features. These include permuting the orders of the bit strings concatenated to form 

8 a, b, c, or d, as well as replacing b with M © G* (a) and d with If{M ® G (a)), fT(M\\a) or fT 

9 (R || a\ (where (j and /f are hash functions of the appropriate lengths. 

1 0 [0073] Although the invention has been described with reference to certain specific 

1 1 embodiments, various modifications thereof will be apparent to those skilled in the art without 

12 departing from the spirit and scope of the invention as outlined in the claims appended hereto. 
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